Securing Text Data in .NET

Imports System.Security
Imports System.ComponentModel

<DefaultEvent("SecureStringChanged")> _
Public Class SecureTextBox
    Inherits System.Windows.Forms.TextBox

#Region "Constructors"

    Public Sub New()
        MyBase.UseSystemPasswordChar = True
    End Sub

#End Region

#Region "Fields and Properties"

    Private WithEvents mSecureString As New SimpleSecureString
    ''' <summary>
    ''' Gets and sets the encrypted string associated with the SecureTextBox.
    ''' </summary>
    <Browsable(False)> _
    <DesignerSerializationVisibility(DesignerSerializationVisibility.Hidden)> _
    Public Property SecureString() As SimpleSecureString
        Get
            Return mSecureString
        End Get
        Set(ByVal value As SimpleSecureString)
            mSecureString = value
            SetText()
            OnSecureStringChanged(EventArgs.Empty)
        End Set
    End Property

#End Region

#Region "Methods"

    ''' <summary>
    ''' Updates the TextBox with a string that represents
    ''' the secure string.
    ''' </summary>
    Private Sub SetText()
        MyBase.Text = New String("*"c, mSecureString.Length)
    End Sub

    ''' <summary>
    ''' Clears the secure string associated with the SecureTextBox.
    ''' </summary>
    Public Shadows Sub Clear()
        ' Unfortunately we can't override Clear.
        mSecureString.Clear()
    End Sub

#End Region

#Region "Event Handlers"

    Private Sub TextBox_KeyDown( _
            ByVal sender As Object, _
            ByVal e As KeyEventArgs) _
            Handles MyBase.KeyDown

        ' This method handles the Delete and Backspace keys.
        ' These keys are not sent to the KeyPress event.

        Dim ch As Char = Convert.ToChar(e.KeyValue)

        e.Handled = True
        e.SuppressKeyPress = True

        Dim caretPos As Integer = SelectionStart

        Select Case e.KeyCode
            Case Keys.Back
                If Me.SelectionLength > 0 Then
                    ' one or more characters are selected

                    mSecureString.Replace( _
                        "", _
                        SelectionStart, _
                        SelectionLength)

                ElseIf Me.SelectionStart > 0 Then
                    ' no characters are selected and we 
                    ' are not at the beginning of the text

                    mSecureString.RemoveAt( _
                        SelectionStart - 1)

                    caretPos -= 1
                Else
                    ' at the beginning of the text with 
                    ' nothing selected 
                    Return ' don't change the SelectionStart
                End If
            Case Keys.Delete
                If SelectionStart _
                    >= mSecureString.Length Then

                    ' at the end of the string
                    Return ' don't change the SelectionStart

                ElseIf SelectionLength > 0 Then
                    ' one or more characters are selected

                    mSecureString.Replace( _
                        "", _
                        SelectionStart, _
                        SelectionLength)

                Else
                    ' no characters are selected

                    mSecureString.RemoveAt( _
                        Me.SelectionStart)

                End If
            Case Else
                ' allow all other keys to be processed
                e.Handled = False
                e.SuppressKeyPress = False
                Return ' don't change the SelectionStart
        End Select

        ' we have to reset the SelectionStart because the 
        ' text is reset when the secure string changes
        Me.SelectionStart = caretPos
        Me.SelectionLength = 0
    End Sub

    Private Sub TextBox_KeyPress( _
            ByVal sender As Object, _
            ByVal e As KeyPressEventArgs) _
            Handles Me.KeyPress

        Dim ch As Char = e.KeyChar

        ' The KeyPress event is only raised for printable 
        ' chars. Control chars are handled in the KeyDown
        ' event handler.

        e.Handled = True

        Dim caretPos As Integer = SelectionStart

        If SelectionStart >= mSecureString.Length Then
            mSecureString.AppendChar(ch)
        ElseIf Me.SelectionLength > 0 Then

            mSecureString.Replace( _
                ch, _
                SelectionStart, _
                SelectionLength)

        Else
            mSecureString.InsertAt(caretPos, ch)
        End If

        ' we have to reset the SelectionStart because we 
        ' reset the text when the secure string changes
        SelectionStart = caretPos + 1
        SelectionLength = 0
    End Sub

    Private Sub mSecureString_SecureStringChanged(ByVal sender As Object, ByVal e As System.EventArgs) Handles mSecureString.SecureStringChanged
        SetText()
        OnSecureStringChanged(e)
    End Sub

#End Region

#Region "Events"

    Public Event SecureStringChanged(ByVal sender As Object, ByVal e As EventArgs)
    Protected Overridable Sub OnSecureStringChanged(ByVal e As EventArgs)
        RaiseEvent SecureStringChanged(Me, e)
    End Sub

#End Region

End Class